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Abstract 

' We define quantum expanders in a natural way. We show that under certain conditions classical expander 

, constructions generalize to the quantum setting, and in particular so does the Lubotzky, Philips and 

' Sarnak construction of Ramanujan expanders from Cayley graphs of the group PGL(2, q). We show 

, that this definition is exactly what is needed for characterizing the complexity of estimating quantum 

■ entropies. 

<: 

O ! 1 Introduction 

(N 



Expanders can be defined either combinatorially or algebraically. In the combinatorial definition a graph 



J> I G = {V,E) is a (i^maa; 5 c) -expander, if every set A C F of cardinality at most Kmax has at least c\A\ 
^ ' neighbors. In the algebraic definition we view G as an operator defined by the normalized adjacency matrix 
of the graph, and we say G is a A-expander if the spectral gap between the first and second largest eigenvalues 
CN I (in absolute value) of this operator is at least 1 — A. 

^ I We are interested in a sequence of graphs {Gn}, with an increasing number of vertices, but constant 

■ degree D. The best possible combinatorial expansion such a family can have is about D — 2, and the best 
possible algebraic expansion is about (see ||Nil91|| ). The algebraic and combinatorial definitions are 
Oh! closely related. Expanders with constant spectral gap have constant combinatorial expansion and vice versa 
IIAM85[|A1o86I . However, this equivalence is not tight, and, in particular, graphs with maximal spectral gap 
may have combinatorial expansion not more than half the degree ||Kah95l , and graphs with almost optimal 
^ , combinatorial expansion (close to the degree) may have non-optimal spectral gap. 

Both notions have proven extremely useful in computer science and elsewhere. Often, the spectral gap 
is used (e.g., whenever a random walk on the expander is used), but sometimes combinatorial expansion 
^ ■ close to the degree is needed (e.g., in the error correcting codes of IISS96II ). 

Thus, for decades, a major goal of computer science has been constructing these marvelous graphs 
explicitly. Pinsker IIPin73ll was the first to observe that non-explicitly , constant degree expanders with very 
good combinatorial expansion exist. Several explicit constructions of constant degree, algebraic expanders 
with some constant (bounded away from zero) spectral gap were given, e.g., in IIMar73[ fGGSll UM87II . 
Lubotzky, Philips and Sarnak IILPS88II and Margulis IIMar88i gave the first Ramanujan graphs, i.e., a family 
{Gn} of degree D graphs with A approaching the optimal value. All the above graphs are Cayley graphs and 
their analysis is algebraic. More recently, MRVWOOII gave a more combinatorial construction, that was used 
in IICRVW02I to construct an explicit construction of graphs with almost optimal combinatorial expansion. 

We refer the interested reader to the excellent survey paper IIHLW06II for a comprehensive treatment of 
expander graphs, their construction and applications. 

1.1 Quantum expanders 

Expanders are often thought of as combinatorial objects. In this view, expanders are sparse graphs that 
have combinatorial expansion properties similar to random graphs. It is difficult to see in this view how to 
generalize the notion to the quantum world. 
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However, most expander constructions, and many of the applications that use expanders, treat expanders 
as algebraic objects, i.e., the graph G = {V, E) is translated to a linear mapping Q from some vector space 
V to itself. Let us describe how this is done. Say G = {V, E) is a graph. We translate F to a vector space V 
of dimension \ V\, with a basis vector \v) for each v ^V. K probability distribution over V then translates 
to a vector YlivP^ 1^) ^^^^ space, with < p^, < 1 and "^^^Pv = 1- The graph G is translated to the linear 
operator Q from V to V which is defined by the normalized adjacency matrix of G. Q is therefore a linear 
mapping C/ : V — > V that can be classically implemented, and maps probability distributions to probabihty 
distributions. 

We extend the algebraic definition to the quantum setting. A general classical state is a classical proba- 
bility distribution over the standard basis {|f )} of V, i.e., vectors of the form \v) as above. A general 
quantum state is a density matrix p = YIPv \'4'v){'^v\, with 0<pt,<l,^Pt; = l and {ipv} being some 
orthonormal basis of V. In the classical world we had a linear operator ^ : V ^ V. In the quantum world a 
feasible quantum state is a matrix over V, i.e., an element of L(y), where L(y) is the set of linear operators 
(matrices) over V. We look for a linear transformation E : Liy) — > L{V). Such a transformation is called 
a super-operator. We want in addition that E can be implemented by some physical process, and this also 
ensures that E maps density matrices to density matrices. Such a linear operators E is called in the literature 
an admissible super-operators. 

We now turn to the regularity condition. Any (directed or undirected) Z)-regular graph G can have its 
edges labeled with 1 to D such that each label d G [D] defines a permutation mapping. We define: 

Definition 1. We say an admissible super-operator E : L{V) L{V) is D-regular if E = J2d ^d, and 

for each d G [D], Ed{X) = UdXU\ for some unitary transformation Ud overV. 

In fact, for many classical constructions the edge labeling is explicitly described in the construction, and 
in particular this is always true whenever G is a Cayley graph. This property was also exploited in several 
constructions (e.g., in IIRVW00[|CRVW02II '). 

Intuitively, a quantum expander is an admissible super-operator E that has a spectral gap. We normalize 
the operator E so that its largest eigenvalue is 1. As in the classical case we want the eigenvector of 
eigenvalue one to be the completely mixed state. We require that all other eigenvalues have a much smaller 
absolute value. In general, however, E need not be normal. This already happens in the classical setting 
whenever we deal with directed graphs. In such a case we need to replace eigenvalues with singular- values. 
Equivalently, we define: 

Definition 2. An admissible superoperator E : L{V) L{V) is a (D, A) expander if E is D-regular and: 

• E{I) = I and the eigenspace of eigenvalue 1 has dimension 1. 

• For any A £ L{V) that is orthogonal to I (with respect to the Hilbert-Schmidt inner product, i.e. 
Tt{AI) = 0) it holds that \\ E{A) < A || A II2. 

A quantum expander is explicit if E can be implemented by a polynomial size circuit. 

Equivalently, we could have replaced the second condition with the requirement that all singular values 
of T other than the largest one (which is 1) are smaller than A. 

1.2 Are there any non-trivial quantum expanders? 

This is indeed a good question, and a major goal of this paper. A first natural attempt is converting a good 
classical Cayley expander, to a quantum super-operator. This indeed can be done, and the resulting super 
operator T : Liy) Liy) is analyzed in Section lA!2l The analysis there shows that T has \ V\ eigenspaces, 
each of dimension \ V\, with eigenvalues A = (Ai = l,...,A|y|), where A is the spectrum of the Cayley 
graph. In particular, the eigenspace of eigenvalue 1 has dimension \ V\ instead of dimension 1. 
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Never the less, Ambainis and Smith obtained the following quantum expander that is impUcit in their 
work: 

Theorem 1.1. I\AS04]I There exists an explicit ( '"1^^ ; ^) quantum expander E : L{V) — > L{V), where 
N = dim{V). 

Their quantum expander is based on the classical Cay ley expander over the Abelian group Zg. As 
explained before, taking the quantum analogue of the classical expander is not enough, and Ambainis and 
Smith obtain their result using a clever trick, essentially working over F4 rather than Z2 . 

The main problem with Abelian groups is that it is impossible to get a constant degree Cayley expander 
over them IIKla84[ |AR94|| . This is reflected in the O(logA^) term in Theorem 11.11 There are constant 
degree, Ramanujan Cayley graphs, i.e., Cayley graphs that achieve the best possible relationship between 
the degree and the spectral gap, but they are built over non-Abelian groups. If one wants to get a constant 
degree quantum expander, then he is forced to work over non-Abelian groups. Can one get constant degree 
quantum expanders at all? 

Our main construction starts with the constant degree Ramanujan expander of IILPS881 . This expander 
is a Cayley graph over the non-Abelian group PGL(2, q). We prove: 

Theorem 1.2. There exists a {D = O(^), A) quantum expander. 

A 

Our construction is not explicit in the sense that it uses the Fourier transform over PGL(2,q), which 
is not known to have an efficient implementation (see IILR92II for a non-trivial, but still not fast enough, 
algorithm). 

The PGL(2,q) quantum expander is as follows: we take two steps on the classical expander graph, with a 
basis change between the two steps. The basis change is a carefully chosen refinement of the Fourier trans- 
formation that maps the standard basis \g) to the basis of the irreducible, invariant subspaces of PGL(2, q). 
Intuitively, in the Abelian case this basis change corresponds to dealing with both the bit and the phase 
levels, and is similar to the construction of quantum eiTor correcting codes by first applying a classical code 
in the standard basis and then in the Fourier basis. However, this intuition is not as clear in the non-Abelian 
case. Furthermore, in the non-Abelian case not every Fourier transform is good. In this work we single out 
a natural algebraic property we need from the underlying group that is sufficient for proving the spectral gap 
of the construction. We then prove that PGL(2, q) respects this property. 

We mention that there are also explicit, constant degree (non-Ramanujan) Cayley expanders over Sn 
and An IIKas05ll . Also, there is an efficient implementation of the Fourier transform over Sn IIBea97L We 
do not know, however, whether Sn (or An) respect our additional property. We discuss this in more detail in 
Section lAJl 

To summarize, Ambainis and Smith showed that good poly-logarithmic-degree quantum expanders ex- 
ist, and their construction is explicit. Theorem IA.6I shows that good constant degree quantum expanders 
non-explicitly exist (with a degree that is the square of the degree of a Ramanujan graph). Recently, we 
showed together with Oded Schwartz IIBST07II that one can use Theorem I A. 6 1 with a Zig-Zag like construc- 
tion, to obtain an explicit, constant degree quantum expander. 

Finally, we show a lower bound on the best achievable spectral gap of quantum expanders. 

Theorem 1.3. Any {D, A) quantum expander satisfies A > ^^^j^ - 

The lower bound differs by a constant from the tight lower bound known on classical expanders. 

1.3 What are quantum expanders good for? 

The first application of quantum expanders was given by Ambainis and Smith themselves. They used these 
expanders to construct short quantum one-time pads. Loosely speaking, they showed how two parties shar- 
ing a random bit string of length n + 0(log n) can communicate an n qubit state such that any eavesdropper 
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cannot learn much about the transmitted state. (A subsequent work by IIDN06II showed how to remove the 
O(logn) term.) 

In this paper we show another appUcation of quantum expanders. Watrous IIWat02ll defined the class 
of quantum statistical zero knowledge languages (QSZK). QSZK is the class of all languages that have a 
quantum interactive proof system, along with an efficient simulator that produces transcripts that for inputs 
in the language are statistically close to the correct ones (for the precise details see llWatOl [ |Wat06ll ) . 

Watrous defined the Quantum State Distinguishability promise problem {QSDa^pY 



Input: Quantum circuits Qoi Qi- 
Accept: If || |Qo) - IQi) lltr > 
Reject: If || |Qo) - \Qi) K < «■ 



where the notation \ Q) denotes the mixed state obtained by running the quantum circuit Q on the initial 
state |0") and tracing out the non-output qubits 0, and 11^11^^ = Tr | A| is the quantum analogue of the 
classical £i-norm (and so in particular || pi — /O2 H^j. is the quantum analogue of the classical variational 
distance of two probability distributions). 

Watrous showed QSDq,^ is complete for honest-verifier-QSZK (QSZKjiv) when < a < < 1. He 
further showed that QSZKjjv is closed under complement, that any problem in QSZKfjv has a 2 message 
proof system and a 3 message public-coin proof system and also that QSZK C PSPACE. Subsequently, in 
nWatOei . he showed that QSZKhv = QSZK. 

The above results have classical analogues. However, in the classical setting there is another canonical 
complete problem, the Entropy Difference problem (ED). There is a natural quantum analogue to ED, the 
Quantum Entropy Difference problem (QED), that we now define: 



Input: Quantum circuits Qo,Qi- 
Accept: If S{\Qo)) - S{\Qi)) > \. 
Reject: If - 5(|Qo)) > \- 

where S{p) is the Von-Neumann entropy of the mixed state We show that QED is QSZK-complete. 
We mention that for this purpose the expanders of Ambainis and Smith given in Theorem 11.11 suffice. 

The problem QED is very natural from a physical point of view. For example, a common way of 
measuring the amount of entanglement between registers A and i? in a pure state il) is by the Von-Neumann 
entropy of Tr^ (| -0) (V" I ) IIPR97II . Now suppose we are given two circuits Qq and Q\, both acting on the same 
initial pure-state |0"), and we want to know which circuit produces more entanglement between A and B. 
Our result shows that this problem is QSZK-complete. This, in particular, shows that the harder problem of 
estimating the amount of entanglement between two registers in a given pure-state is QSZK-hard. 

We believe these two applications are a good indication to the usefulness of this notion. We expect that 
with time other applications will be found. 

Our proof that QED is QSZK-complete uses a quantum variant of classical balanced extractors. We 
explain this variant in Section IH We show there that good balanced quantum extractors exist. Surprisingly, 
we believe that unlike the classical case, unbalanced quantum extractors do not exist. 

'Here we assume that a quantum circuit also designates a set of output qubits. 

density matrix p is positive semi-definite and has trace 1. Therefore its eigenvalues are all non-negative and sum up to 1, and 
can be thought of as defining a probability distribution. The Von-Neumann entropy of p is the Shannon entropy of the eigenvalues 
of p. 
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1.4 Summary and organization 



In classical computation there is a long line of research studying "conductors": objects that manipulate 
their source entropy, using few independent random bits. This research resulted in beautiful constructions of 
expanders and extractors, and an amazing variety of applications. We initiate the study of such "conductors" 
manipulating the entropy of quantum systems. 

On the one-hand we show that expander-based constructions generalize to the quantum setting (with 
effort, and not always, but at least in some important cases). On the other hand, we believe all the huge 
body of work relating classical extractors, condensers and such that map a huge universe to a much smaller 
universe, is not likely to have a quantum analogue (see Section 131). We think this study deserves interest at 
its own right. 

We also show two neat applications for quantum expanders. One, that was already given in IIAS04II 
and a new one that we give here: we characterize the complexity of approximating entropies. This proof 
generalizes classical ideas, together with new technical work that is needed for the quantum setting. 

The paper is organized as follows. After the preliminaries (Section |2l), we give an intuitive exposition 
of our constant degree expander, and the analysis, in Section [3] A complete treatment is given in Section 
lAl in the Appendix. In Section |4] we discuss extractors, and discuss why we believe unbalanced quantum 
extractors are not useful. The final section is devoted to proving the completeness of QED in QSZK. Here, 
again, we give an intuitive exposition in the main text, with the formal details in the Appendix. 

2 Preliminaries 

We first define the classical Renyi entropy. Let P = (pi , . . . , pm) be a classical probability distribution. The 
Shannon entropy of P is H{P) = YllLi Pi Ig The min-entropy of P is H^{P) = minj Ig j-. The Renyi 
entropy of P is H2{P) = Ig odiP)' where Col(P) = X^pf is the colUsion probability of the distribution 
defined by Col(-P) = Fvx^y[x = y] when x, y are sampled from P. 

Now let p G D{V) be a density matrix (where y is a Hilbert space, L{V) is the set of linear operators 
over V and D{V) is the set of positive semi-definite operators in L{V) with trace 1, i.e., all density matrices 
over V). Let a = (ai, . . . , oat) be the set of eigenvalues of p. Since p is positive semi-definite, all these 
eigenvalues are non-negative. Since Tr(p) = 1 their sum is 1. Thus we can view a as a classical probability 
distribution. The von Neumann entropy of p is S{p) = H{a). The min-entropy of p is Hoc{p) = Hoo{a). 
The Renyi entropy of p is H2{p) = H2{a). The analogue of the collision probability is simply Tr(p^) = 
^.af = ||/9||2. We remark that for any distribution P,i7oo(^) < H2{P) < H{P) and2Hoo{P) > H2{P). 

The statistical difference between two classical distributions P = {pi, . . . ,Pm) and Q = {qi, . . . , q^) 
is SD(P, Q) = ^ X^i^i \Pi ~ i-S-' half the li norm of P — Q. This can be generalized to the quantum 
world by defining the trace-norm of a matrix X £ L{V) to be || X ||^^ = Tr(|X|), where \X\ = VXXt, 
and defining the trace distance between density matrices p and cr to be ^ || p — a 

3 Quantum expanders from non-Abelian Cayley graphs 

As we said before, our quantum expander takes two steps on a Cayley expander (over the group PGL(2,q)) 
with a basis change between each of the steps, and the basis change is a carefully chosen transformation. In 
this section we give a bird's view of the proof. We focus on the ideas, obstacles and solutions, and try to 
give an informal presentation. 

Our starting point is generalizing a single step on a Cayley graph to the quantum setting. We fix an 
arbitrary (Abelian or non-Abelian) group G of order N, and a subset F of group elements closed under 
inverse. The Cayley graph associated with F, C{G, F), is a graph over N vertices, with an edge between 
{gi , (72) iff 91 = 921 for some 7 G F. Rather then thinking of the Cayley graph as a graph, we prefer to think 
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of it as the Unear operator over C[G] associated with the adjacency matrix of G, where C[G] is the vector 
space spanned by the basis elements l^) for each g ^ G. I.e., it is the linear operator M = ^-yer l^7)(^l- 
We now define our basic superoperator T : L{C[G]) —>■ L{C[G]). The superoperator has a register R of 
dimension |r| that is initialized at |o). It does the following: 

• It first applies Hadamard on register R (getting into the density matrix ^,gp I7) (7']). 

• Then, it applies the unitary transformation Z : \g, 7) {gj, 7). This transformation is a permutation 
over the standai^d basis, and hence unitary. It is also classically easy to compute in both directions, 
and therefore has an efficient quantum circuit. 

• Finally, it measures register R. 

Thus we have: T{p) = Tvr[ Z{I H){p |o)(o|)(/ » H)Z'' ]. It can be easily checked that over 
"classical" states (a density matrix p that is diagonal in the standard basis) T coincides with M. Also, by 
definition, T is |r|-regular. 

The first thing to figure out is the eigenspace structure of the super-operator T. This turns out to be 
as follows. T has N orthogonal eigen-spaces, each of dimension N, and the eigenvalues Ai, . . . , Xn are 
those of M (the orthogonality is under the inner-product of L{C[G]) defined by {A\B) = Tv{AB'f)). In 
particular, if we start with a good Cayley graph where Ai = 1 and all other eigenvalues have absolute value 
at most A, then T has an eigenspace Wi of dimension N with eigenvalue 1, and all other eigenvalues have 
absolute value at most A. The fact that the dimension of Wi is larger than 1 is not good for us, because it 
means that T has no spectral gap. 

So, now we take a closer look at Wi and we discover that it is spanned by {Ag | 51 G G} where Ag = 
J2x \9^) These operators Ag are what is called the regular representation of G. Namely, if we denote 
/Oreg(ff) = Ag, then prcg : G ^ L(C[G']) is a group homomorphism (namely, Prcg(fl'i • 52) = Preg{gi) ■ 
Preg(fl'2))- Furthermore, a basic theorem of representation theory says that there is a basis change under 
which all the operators Ag = Prc%{g) simultaneously block-diagonalize, with the blocks corresponding to 
the irreducible representations of G. This (non-unique) basis change is called the Fourier transform of G. 

Let us first consider the case where G is Abelian, and let e denote the identity element in G. In this case 
all the irreducible representations of G have dimension one, and the Fourier transform U simultaneously 
diagonalizes all the operators Ag = /?rcg(5)- The elements {Ag = Prcg{g)} form an orthonormal basis of 
Wi. Doing the basis change, they all become diagonal, i.e., "classical" states. Furthermore, Ag = Prog(e) = 
/ is mapped to / (as is true in any basis change) and all other basis elements are mapped to orthogonal 
states (as U is unitary). We therefore expect that applying T again now, is equivalent to applying M on the 
classical state, and will result in a unique eigenvector of eigenvalue 1, with all other eigenvalues being at 
most A. 

So our (Abelian) quantum expander is as follows. We let U be the Fourier transform over G, and the 
quantum expander is the superoperator 

E{p) = T{UT{p)U^). 

A simple check shows that E is indeed a A-expander, and its spectral gap is the same as that of G. Also, 
cleai^ly, £'is |rp-regulai\ 

We now turn to the non-Abelian case. Here most iiTcducible representations have dimension larger than 
1, and as a result the basis change does not diagonalize all Ag = Prcg{g), but rather just block-diagonalizes 
them, with blocks corresponding to the irreducible representations. In particular, doing the Fourier transform 
does not map Ag = Prcgig) to "classical" states. Never the less, this does not necessarily mean that the above 
approach fails. In fact, it turns out that a sufficient requirement for a good basis change is that for any gi e 
and any g2, it holds that 
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TV([/prcg(9l)t/Vrcg(92)) = 0. 



(1) 



Intuitively, we can do the analysis separately for elements in Wi and elements in W{- - the space per- 
pendicular to Wi (this is technically more complicated, see Lemma lA!4l) . Elements in W-^ are. immediately 
shortened by the first application of T. Elements in Spm{Ag = Prcgid) I 5 / e} ai"e kept in place by the 
first application of T, but are mapped to W-^ by the basis change, and therefore are shortened by the second 
application of T. Together, if [/ is a good basis change then E{p) = T{UT{p)W) is a A-expander. 

But does a good basis change always exist? 

We consider the dihedral group as an illuminating example. The dihedral group has irreducible represen- 
tations of dimension 2 (and a few of dimension 1). The dihedral group also has a cardinality two subgroup 
H = {e, s}, where s is the reflection element. The Fourier transform associates the eigen-spaces of the 
iiTcducible representations, to elements of G. Now, imagine that we associate the dimension-2 blocks with 
cosets of H. A moment of thought reveals that if §2 ^ H then Equation (dJ is satisfied! This is because 
A = U pj:cg{gi)U'^ has non-zero elements only on the 2 by 2 blocks, while B = Preg{92) = Ylx \9'2x){x\ 
has non-zero elements only outside these 2 by 2 blocks, and so the inner product {A\B) = Tr(A5t) = 
AijBij must be zero. 

We need also to consider the case where g2 ^ H = {e, s}. If §2 = e then Tr([//9i.cg(5i)f^Vrcg(92)) = 
Tr(prcg(5i)) and the analysis is simple. We are left with the case g2 = s. Recall that Tr {AB'<) = 

J AijBi j. We can interpret the expression Tr(C//Jreg(5'i)t^Vreg(s)) as the sum of all entries i,j of 
UpTcg{9i)U^ that belong to the set P = {{is,i)}. We now use the fact that each iiTcducible representa- 
tion appears in the regular representation with multiplicity that equals its dimension. In matrix language 
this means that for each dimension 2 irreducible representation, there are two corresponding blocks in the 
decomposition, and the entries in these two blocks can be made identical (see Section lATTl for more back- 
ground on representation theory). As the blocks correspond to cosets of H, multiplication by 52 = s has the 
same effect in the two cosets. I.e., an entry of one block is in P and is added to the sum, iff the coiTcsponding 
entry in the other block is also in P and is also added to the sum. We can therefore force a zero sum, by 
forcing one block to be the negative of the other block, which can be done by an easy manipulation of the 
Fourier transform. 

At first, the above solution looks ad hoc, and very specific to the dihedral group. So we try to abstract 
the ingredients that have been used in the solution. 

The Fourier transform is a unitary mapping from the standard basis of C[G], to the Fourier basis. 
It can be formally defined as follows. Let G denote the set of all inequivalent irreducible representations of 
G. For a representation p let dp denote the dimension of p. We define the transformation F by 



It can be checked that F is unitary and that it indeed block-digaonlizes the regular- representations, 
namely. 



F maps C[G] to a vector space of the same dimension that is spanned by | |p, i, j) : p G G, 1 < i, j < dp 
To complete the specification of the Fourier transform we also need to specify a map S between {\p, 




FpTcg{9)F^ = E E \P^i){p,i\'^ E Phi'^9)\i){i 



p^Ql<j<dp l<i,i'<dp 



I.e., for each p ^ G and j < dp, we have a. dp x dp block whose entries are p{g). 
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and {\g) : g G G}. In the Abelian case there is a canonical map S between i, j) : p £ G, I = j = l| 

and {\g) ■ g € G}, because when G is Abelian G is isomorphic to G. However, when G is not Abelian 
things are more complicated. It is always true that J^p^Q^'p ~ 1^1' there is always a bijection 

between {\p,i,j)} and {\g) : g G G}. However, it is not known, in general, how to find such a natural 
bijection. 

For example, for the symmetric group 5„ the question takes the following form. We look for bijections 
/ from pairs (P, T) of standard shapes to Sn (a shape corresponds to an irreducible representation of Sn, and 
its dimension is the number of standard shapes of that shape). The question of finding an explicit bijection 
/ from pairs (P, T) of standard shapes to 5„ is a basic question in the study of the representation theory 
of Sn- The canonical algorithm doing so is the "Robinson-Schensted" algorithm IIRob38[[Sch61ll that was 
extensively studied later on (see |Sag01[ , and especially Chapter 3 that is almost completely dedicated to 
this algorithm). 

Looking back at the solution we gave for the dihedral group we see that we can express it as follows. 
We made sure that a block that corresponds to an irreducible representation is contained in a coset of H, 
and different copies of the same representation get the same indices within H. Generalizing this further, 
we see that what we actually used is a mapping S : {p,i,j} G that is product, i.e., for every p ^ G, 
S{p,i,j) = fi{i) • /2(i) for some functions /i,/2 : [dp] x [dp] —>■ G (the functions /i and /2 may be 
specific to p). In the dihedral group, this amounts to /2 selecting a coset representative, and fi selecting an 
index inside the coset. But, in fact, any product mapping S is good. 

It is not clear at all that for every group G such a product mapping exists. It is trivial for Abelian groups, 
and simple for the dihedral group (using cosets of {e, s} for example). It is not clear what is the situation for 
Sn - the Robinson-Schensted is not a product mapping, but using specific information about Sn, for 7i < 6, 
we found out that a product mapping exists. Never the less, we were able to prove that PGL(2, q) has a 
product mapping, using information about its subgroup structure, and its irreducible representations. 

Putting these things together, we get a quantum expander E{p) = T{UT{p)U'^), with T being a single 
quantum step on a the Cayley expander, and U being a good basis change. U is obtained by doing the 
standard Fourier transform F followed by the a product mapping S, and with adding appropriate phases to 
the basis vectors, so as different copies of the same irreducible representation cancel out. 

Clearly, the above discussion is intuitive, and there are many gaps to fill. This is done in Appendix El 
where we repeat everything in a relaxed way and with all the necessary details. In Sec lA.ll we give some 
background on representation theory. Section IA.2I analyzes a single quantum step on a Cayley graph and 
in Section IA.3I we analyze the quantum expander over Abelian groups. Section IA.4I singles out Property 
(d) as a sufficient condition for a good basis change, and Section IA.5I shows that all we need for that is 
finding a product mapping S. Finally, we prove in Section IA!6] that PGL(2, q) has such a product mapping, 
completing the correctness proof of our constant degree quantum expander. 



4 Quantum extractors 

The balanced case. The classical proof that ED is SZK-complete uses balanced extractors. A balanced 
extractor is a function E : {0, 1}" x {0, l}"^ — > {0, 1}". We say P is a {k, e) extractor if for every 
distribution X on {0, 1}" that has k min-entropy the distribution E{X, Ud) obtained by sampling x ^ X, 
y 6 {0, 1}'^ and outputting E{x, y), is e-close to uniform. We now define balanced quantum extractors. 

Definition 3. Let V be a Hilbert space of dimension N. A superoperator T : L[V) L{V) is a (k, d, e) 



quantum extractor, ifT is -regular and for every p G D{V) with Hoo{p) > k we have 



Tp-I 



where I = jjl. We say T is efficient ifT can be implemented by a polynomial-size quantum circuit. 



< e, 

tr 



We mention that if T is 2'^-re gular (and, in particular, if it is a {k, d, e) quantum extractor) then for any 
p G L{V) it holds that S{Tp) < S{p) + d, i.e., no matter what, the extractor never adds more than d entropy 
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to any input system. 

Classically, balanced extractors are closely related to expanders (e.g., IIGW971 ). This generalizes to the 
quantum setting. We prove: 

Lemma 4.1. IfT : L(y) — > L{V) is a [D = 2'^, A) quantum expander, then for every t > 0, T is also a 
{k = n — t, d, e) quantum extractor with e = 2*/^ • A. 

We give the easy proof in Section O in the Appendix. In particular, we get an (n — t, d, e) balanced 
quantum extractor T : L{V) L{V) where n = dim{V), and d = 2{t + 2 log(i)) + 0(1) using Theorem 
IA.6l (or the explicit version given in IIBST07II ). 

We use the last lemma to prove our lower bound on the spectral gap of quantum expanders. 

Theorem |1.3[ Any {D, X) quantum expander satisfies A > ^^.^j^ - 

In the classical world a tight bound of about "^^^^^ has been proved ||Nil91i The proof there is both 
algebraic (using eigenvalues) and combinatorial (using paths in the graph). We do not see how to generalize 
the combinatorial component of the proof. Instead we give an algebraic proof. The proof idea is to take a 
density matrix which is uniform on a set of "small size". Applying the extractor yields a density matrix close 
to the completely mixed state. Such a matrix must have a high rank. On the other hand, because we started 
with a low-rank matrix, the resulting density matrix cannot have a too-high rank (since E is D-regular). The 
formal details are given in SectionOin the Appendix. 

The unbalanced case. A natural generalization of Definition [3] is for a superoperator T : L(y) — > 
L{W) where V, W are Hilbert spaces of dimensions arbitrary dimensions and M. I.e., here we let W 
be different than V, and, in particular, the superoperator T can map a large Hilbert space to a much 
smaller Hilbert space W. In the classical case this corresponds to hashing a large universe {0, 1}" to a much 
smaller universe {0, 1}'". Indeed, in the classical world highly unbalanced extractors exist with a very 
short seed length d. These (and related objects like dispersers, condensers and unbalanced expanders) have 
numerous applications. There is also a huge body of work constructing explicitly (most of) these objects. 
See IICRVW02I for an attempt to put some order in the zoo of definitions, and ||Nis96[[Sha02ll for a survey 
of applications and constructions. 

However, here we see a difference between the classical and the quantum world. In the classical world 
if X has k entropy, and we add d more uniform bits, then the final output distribution can have at most 
k + d entropy. If we then "ignore" some of the output bits, we can only decrease the entropy of the output 
distribution. In particular, if the output distribution has m entropy, then most of it (namely, m — d) came 
from the source X. We also had a similar property for balanced quantum extractors: for any input p we had 
S{Tp) < S{p) + d. 

In the unbalanced case, however, we output m <^ 7i qubits, and so we trace-out (or "ignore") qubits. 
This, by itself, may increase the entropy. For example, a mixed state that is with probability one in some 
pure-state has entropy zero (it is completely determined). Tracing out k bits of the system, may result 
in a mixed state having k entropy. If we trace out n/2 bits, at least theoretically, it is possible that our 
extractor starts with a pure state as an input p (i.e., p has zero entropy) and ends up with Tp being the 
completely mixed state. Notice that at most d of this entropy comes from the seed, and the rest comes from 
the tracing-out. We believe this makes any unbalanced extractor with m < n/2 not useful. For example, 
the property S{Tp) < S{p) + d (true for balanced quantum extractors) is crucial for our proof that QED is 
QSZK-complete. We believe that slightly unbalanced expander constructions (e.g., IIMor95ll ) can probably 
be converted to useful, slightly unbalanced quantum extractors. 

5 The complexity of estimating entropy 

In this section we show that the QED problem (as defined in the introduction) is QSZK-complete. We 
do that by showing that QED reduces to QSD and vice versa, using the already known fact that QSD is 
QSZK-complete. 



9 



Proving QED < QSD is a bit tricky. We first sliow a that related problem, Quantum Entropy Approxi- 
mation (QEA), reduces to QSD. QEA is the following promise problem: 



Input: A Quantum circuit Q and a non-negative integer t. 
Accept: If 5(|Q)) >t + \. 
Reject: \i S{\Q)) <t-\. 



QEA is the problem of comparing the entropy of a given quantum circuit to some known threshold t, 
instead of comparing the entropies of two quantum circuits as in QED. Our proof that QEA < QSD uses 
quantum expanders and extractors, and we discuss it next. 

We begin with the classical intuition why EA reduces to SD (EA is the same promise problem, but with 
the input being a classical circuit). We are given a circuit C and we want to distinguish between the cases the 
distribution it defines has substantially more or less than t entropy. First assume that the distribution is flat, 
i.e., all elements that have a non-zero probability in the distribution, have equal probability. In such a case 
we can apply an extractor on the n output bits of C, hashing it to about t bits. If the input distribution has 
high entropy, it also has high min-entropy (because for flat distributions entropy is the same as min-entropy) 
and therefore the output of the extractor is close to uniform. If, on the other hand, the circuit entropy is 
less than t — d — 1, where d is the extractor seed length, than even after applying the extractor the output 
distribution has at most t — 1/2 entropy, and therefore it must be far away from uniform. We get a reduction 
toSD. 

There are, of course, a few gaps to complete. First, our source is not necessarily flat. This is solved 
in the classical case by taking many independent copies of the circuit, which makes the output distribution 
"close" to "nearly-flat" . A simple analysis shows that this flattening works also in the quantum setting. 
Also, we need to amplify the gap we have between enti"opy t + 1/2 and t — 1/2 to a gap lai^ger than d (the 
seed length). This, again, is solved by taking many independent copies of C, because S{C^'^) = qS{C), 
and works the same way in the quantum setting. 

The interesting question is what is needed in the quantum case from the quantum analogue of classical 
extractors. As it turns out, what is needed is that sources with high min-entropy are mapped close to the 
completely mixed state, whereas all sources of low min-entropy are mapped far away from it. The first 
condition is clearly satisfied by our Definition |3] The second condition is implied by the regularity of the 
extractor: a. D = 2'^ regular extractor can never add more than d entropy to a source, and so sources with 
low min-entropy are mapped to sources with low min-entropy, and such sources (with the right parameters) 
are far away from uniform. The formal proof is given in Section IbTT] 

We remark that we believe that exactly this property fails in the unbalanced case, i.e., there are input 
sources with low min-entropy (e.g. pure states) that are mapped close to the completely mixed state, and this 
additional entropy is obtained not because of the seed, but rather because we have an unbalanced extractor 
that traces out registers. 

This completes the proof that QEA reduces to QSD. As Watrous showed that QSD < QSD, we get 
that QEA < QSD. We next show that QEA < QSD implies QED < QSD using a standard classical trick. 
We can express: QED(Qo, Qi) = Vt=i iHQo, t) G QEAy) A ((Qi, t) G QEAjy)]- Thus, if QEA reduces 
to QSD (as we proved), we can express QED as a formula over QSD. We then take the classical result that 
any Boolean formula over SD reduces to SD, and generalize it to the quantum setting, concluding that QED 
reduces to QSD as desired. The full details (and this time just for completeness, because the proof closely 
follows the classical one) are given in Section IR!21 This completes the proof that QED < QSD. 

The direction that QSD < QED follows the classical reduction, but using the Holevo bound from 
quantum information theory. The details are given in Section lB3l Altogether, we see that QED is QSZK 
complete. 
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A Quantum expanders from non-Abelian Cayley graphs 

As we said before, our quantum expander takes two steps on a Cayley expander (over the group PGL(2,q)) 
with a basis change between each of the steps, and the basis change is a carefully chosen transformation. 

First, in Subsection |A.2[ we define and analyze taking one step on a (Abelian or non-Abelian) Cayley 
graph. Then, in Subsection lA.3l we analyze the Abelian case. We do not use the results of Subsection I A. 3l for 
analyzing PGL(2,q), but never the less we recommend reading this section because many of its techniques 
are later on generalized to the non-Abelian case. Then, we study a general template for constructing quantum 
expanders over non-Abelian groups with a certain property (Subsections IA.4[ IA.5I) . Finally, we show that 
PGL(2,q) has this required property (Subsection lA.6l ). 

We begin with some representation theory background. 

A.l Representation Theory Background 

We survey some basic elements of representation theory. For complete accounts, consult the books of Serre 
IISer77l or Fulton and Harris ||HF91i The exposition below heavily uses the one given in MHRTOOi 

A representation p of a finite group G is a homomorphism p : G GL{V), where V is a. (finite- 
dimensional) vector space over C and GL{V) denotes the group of invertible linear operators on V. Fixing 
a basis for V, each p{g) may be realized as a. d x d matrix over C, where d is the dimension of V. As p is 
a homomorphism, for any g,h £ G, p{gh) = p{g)p{h) (this second product being matrix multiplication). 
The dimension dp of the representation p is d, the dimension of V . 

We say that two representations pi : G — > GL{V) and p2 : G — > GL(VF) of a group G are isomorphic 
when there is a linear isomorphism of the two vector spaces (j) : V ^ W so that for all g £ G, (j)pi (g) = 
P2{g)4>- In this case, we write pi = p2. Up to isomorphism, a finite group has a finite number of irreducible 
representations; we let G denote this collection (of representations). 

We say that a subspace C y is an invariant subspace of a representation p : G —>^ Gh{V) if 
p{9)W ^ ^ for ^11 9 ^ G. The zero subspace and the subspace V are always invariant. If no nonzero 
proper subspaces are invariant, the representation is said to be irreducible. 

If /9 : G — > GL(y) is a representation, V = Vi (B V2 and each Vi is an invariant sub-space of p, then 
p{g) defines two linear representations pi : G ^ GL{Vi) such that p{g) = pi{g) + P2{g)- We then write 
p = pi ® P2- Any representation p can be written p = pi © P2 © • ■ ■ © Pfe. where each pi is irreducible. In 
particular, there is a basis in which every matrix p{g) is block diagonal, the ith block corresponding to the 
zth representation in the decomposition. While this decomposition is not, in general, unique, the number of 
times a given irreducible representation appears in this decomposition (up to isomorphism) depends only on 
the original representation p. 

A representation p of a group G is also automatically a representation of any subgroup H. We refer to 
this restricted representation on H as Res/^p. Note that even representations that are irreducible over G 
may be reducible when restricted to H. 

The group algebra C[G] of a group G is a vector space of dimension |G| over C, with an orthonormal 
basis {\g) \ g £ G} and multiplication o-g \9) ■ E bg' \g') = S^s' 1^ " d')- The group algebra is 

isomorphic to the set {/ : G ^ C} with the isomorphism being / Ylg fio) l^)- The inner product in 
C[G] translates to the famihar inner product (/, h) = f{9)h{g). The regular representation prcg : G — > 
GL(C[G])is defined by Preg(s) : \g) ^ \sg), for any g G G. Notice that preg(s) is a permutation matrix for 
any s G G. 
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An interesting fact about the regular representation is that it contains every irreducible representation of 
G. In particular, if pi , . . . , are the irreducible representations of G with dimensions dp^ , ■ ■ ■ , dp^ , then 

Preg = dp^pi © • • • ® dp^pk, 

SO that the regular representation contains each irreducible representation p exactly dp times. 

The Fourier transform over G is a unitary transformation F mapping the standard basis {\g) g ^ G} 
to the basis of the invariant subspaces of prcg- That is, for any g ^ G, the matrix Fprcg{g)F'^ is a block- 
diagonal matrix, where each block corresponds to p{g) for some in^educible representation p of G. The 
Fourier transform is unique, up to a permutation of the blocks and up to a choice of basis for p for each 
iiTcducible p. 

Let G denote the set of all inequivalent iiTcducible representations of G. For a representation p let dp 
denote the dimension of p. We define a transform F by 

^1^) = \|■^^P^di9)\p,i,j) ■ 



peG i<* J<f^P 



This transformation is unique up to a choice of a unitary map between Span ^\p,i, j) : p G G, I < i,j < dp} 
and Span { I (7) : g G G}. 

The following analysis shows that F is indeed a Fourier transform, in the sense that it block diagonalizes 
the regular representations (where each {\p,i, j) {p,i' , j\ 1 < < dp} corresponds to a block). 

FpTcg{g)F^ = Y Yl Y ^^'^-S^Pi,ji9x)p'i,^y{x)\p,i,j){p,i',j'\ 

xeC p^p>(zGl<id<dp;l<i',j'<dp, ' ' 

= Y Y Y Y Pi,ki9)pk,j{x)p'i,j,ix)\p,i,j){p',i',j'\ 

xeG p^pi(zQl<i,j<dp; l<i',j'<dp, ' ' l<A:<dp 



Y Y Y ft.fc(g) ( |(^/ Yp^'i'^^^p'i'j'^^n \P''^'^Kp^'^''^'\ 

p,p'&G^<^'3<dp]l<i' ,j'<dp, l<k<dp \ ' ' x&G / 

Y Y Y PiA9)^P,p'^k,i'Sj,j'\p,i,j){p',i',f\ 

p,p'&G^<'^'j<dp; l<i'j'<dpi l<k<dp 

Y Y Pi,i'{9)\p,hj){p,i' ,j\ 



In the above analysis we have used the beautiful second orthogonality relation: ^ ^ Y^^i^g PiJ (^) P'i' j' (^) 



^p,p'h,i'^j,j'- 



A.2 A single step on a Cayley graph 

We now fix an arbitrary (Abelian or non-Abelian) group G of order N, and a subset F of group elements 
closed under inverse. The Cayley graph associated with F, C{G, F), is a graph over N vertices, with an 
edge between ((71,52) iff gi = 527 for some 7 G F. C(G, F) is a regular directed graph of degree |F|. 
Rather then thinking of the Cayley graph as a graph, we prefer to think of it as a linear- operator over C[G]. 
We associate the graph with the operator that is its normalized adjacency matrix M (the normalization is 
such that the operator norm is 1). This operator is thus M = X]7er I ^7) (^^ ill- 

'in our definition the generators act from the right. Sometimes the Cayley graph is defined with left action, i.e., gi is connected 
to g2 iff gi — 732- However, note that if we define the invertible linear transformation P that maps the basis vector \g) to the basis 
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Notice that M = C{G, F) is a symmetric operator, and therefore diagonaUzes with real eigenvalues. We 
denote by Ai > . . . > Aat the eigenvalues of M with orthonormal eigenvectors vi, . . . ,vj\f (i.e., || II2 = 1). 
As M is regular, we have Ai = 1 and A = maxj>i |Aj| < 1. 

We now define our basic superoperator T : L{C[G]) —>■ L{C[G]). The superoperator has a register R of 
dimension |r| that is initialized at |o). It does the following: 

• It first applies Hadamard on register R (getting into the density matrix y I7) 

• Then, it applies the unitary transformation Z : |g, 7) — > 157, 7)- This transformation is a permutation 
over the standard basis, and hence unitary. It is also classically easy to compute in both directions, 
and therefore has an efficient quantum circuit. 

• Finally, it measures register R. 

Thus we have: T{p) = TtrI Z{I ® H){p ® |o)(o|)(/ ® i?)Zt ]. 

We begin by identifying the eigenvectors and eigenvalues of T. We may think of an eigenvector Vi € 
as an element of C[G], \vi) = Ylg '^iid) Iq)- We also define the linear transformation R : C[G] —>■ L{C[G]) 
by R \g) = \g) {g\. With this notation we define: 

= Prcg{9){R\vi)) = ^Vi{x)\gx){x\ 

Lemma A.l. The vectors {pi^g \ i = 1, . . . , N, g £ G} form an orthonormal basis of L[C[G]), and pi^g is 
an eigenvector ofT with eigenvalue Xi^g = Aj. 

Proof We first notice that T(|gi)(52|) = Trr[^ E^i,^^ bi, 7i) (^2, 72I C^^] = ^ I5i7)(527l- 
Now, 

T{pi,g) = TC^Viix)\gx){x\) = '^Vi{x)T{\gx){x\) 

X X 

= ^^^Mx)\9Xj){x-f\ = |^^^^i(a;)/3rcg(fi') k7)(2;7l 

' ' x,y ' ' x,'y 

= Pr<^gi9)^^^Vi{x)\x-i){x-i\ = prcg{g)RC^Vi{x)^S2\x-l)) 

= p,^g{g)RC^Vi{x)M\x)) 

X 

= p,,^{g)R{M{Y^v^{x)\x))) = p,,g{g)R{M\vi)) 

X 

= Pregig) ■ RiWvi)) = XiPTcg{g)R{\Vi)) = \iPi,g. 

To see orthonormality notice that for gi 7^ 52, ^'^{pi,gp\i g') — ^ simply because for all (A;, I) for at least 
one of the matrices the {k,l) entry is zero. If gi = 52 = 5 then Tv{pi gp\i = {vii\vi) = Si^ii. As the 
number of vectors {pi^g} is A^^ they form an orthonormal basis for L(C[G]). □ 

vector Is"""^), then PMP^^ — PAIP maps a; to jpj lix^^"/)^^) = jf^ X^-y ll^^^) ~ jr^ X^-y l"/^) ^rid so the right action 
is M and the left action is PAI P~^, and therefore they are similar and in particular have the same spectrum. 

■*We remark that if we think of T as an operator over C[G x G] (identifying |a;)(y| with \x, y)) then T itself is a Cayley graph 
with the set of operators being {(7, 7) j 7 G T}. Furthermore, if we look at = {{g, g)\ g (z G} then is a subgroup of G x G 
and W is invariant under T. In general, for every (gi, 32) £ G x G, the left coset {gi,g2)W — {{gig, g2g) \ g G G} is invariant 
under T. 
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Given v G C[G] we can decompose it and express it as = + where G Span{|tii)} and 
v-^ G Span{|f2) , • • • , \vn)}- In analogy, for A G L(C[G]) we can decompose it to ^ = + A-^ where 
All G /-fll = Span{/ii^g I G G} and A"*- G /i"*" = Spanj/ij^g | i 7^ 1,17 G G}. Notice that T has eigenvalue 
Aj on g and so in particular has eigenvalue 1 = Ai on /^JL Also, let us denote A = maxj^i |Ai|. We have: 

Claim A.l. For any A G fx^, \\ T{A) \\l < A^ M \\l 

Proof. Express A = Ei^i^g Pi,gf^i,g- Then \\A\\l = and r(yl) = J2i^i^g Pi,g^i^^i,g- In 

particular, || T{A) \\l = J2i^^,g \f3i,g\^\M^ < a' M \\l □ 

A.3 The Abelian Expander 

In this section we describe a quantum expander based on a Cayley graph of an Abelian group, G. When 
G is Abelian, all the iiTcducible representations are of dimension 1 and these are the group characters H. 
There are exactly N different characters, and we can associate each g ^ G with a character Xg such that 
Xg{x) = Xx{g)- We associate each character x with the norm one vector 1X9) = J2x Xg{^) \ ^) in C[G]. 
The eigenvectors of the Cayley graph are exactly the set of characters \vg) = \xg)- 

We now describe the quantum expander. We let U be the Fourier transform over G, i.e., the unitary 
transformation mapping \g) to \xg)- Our expander is the superoperator 

Eip)=T{UTip)U^). 

We claim: 

Claim A.2. Ufig,iU'< = Xi{g~^) ■ /^i.^-i- 
Proof. 

Ufig^iU^ = Upros{^R\xg)U^ = -j=J2xg{x)U\ix){x\U^ 

^ X 

^ X 

= 1^7^ Yl Xg{x)xix{y)xxiy')\y){y'\ 

iV V iV — , 

= 'T^Y^'^y^ ij^^Xxigyy''^)] \y){y'\ 

^ y,y' 
y' 

= Xi{9~^) ■ Pvcg{g'^)R\xi) = Xi{9~^) ■ f^i,g-i 



□ 

We claim: 

Lemma A.2. E is a (|rp, A) quantum expander 

Proof. The regularity is clear from the way the superoperator E is defined. We turn to the spectral gap. 
It is easy to check that E{I) = I. Furthermore, fix any x G L(C[G]) that is perpendicular to /. Write 



'a character is a homomorphism from G to C, .i.e., a function x : G ^ C such that ^(ffiSa) = x(5i)x(P2)- 
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X = xll + x"*- where G = Span{//i^g | 1 / 5 G G} and x"*- e //-*-. Given Claim lAl2] one can verify 
that E{x\\)±E{x-^). In particular 

\\E{x)\\l = ||£;(xll)||^ + ||^(x^)||i 

< ||r(C/xllC/t)||2 + ||T(x^)||2 

< A'||xll||i + A'||x^||2 = A'||x||i. 

The first inequality is due to the fact that T has eigenvalue 1 on x" and both T and U have operator 
norm at most 1. The second inequality is by Claims lAi2l and IaITI □ 

A.4 Template for a quantum expander over a general group 

In this subsection we show how to construct a quantum expander over any group G that possess some general 
property. We later show that the PGL(2, q) group possesses this property. 
Similar to the Abelian case, the expander will be of the form 

Eip) = T{UT{p)U^), 

where U will be the Fourier transform over G. Unlike the Abelian case, in the non- Abelian case G has many 
representations of dimension greater than 1. Thus, a significant part of describing U will be to describe the 
basis for each one of the prcg -invariant subspaces. The property that we need from the unitary transformation 
C/is: 

Definition 4. We say U is a good basis change if for any gi ^ e (where e denotes the identity element) it 
holds that 

^(^Prcg(ffl)t/Vrcg(ff2)) = 0. (2) 

The intuition behind this choice is as follows. As before, let W = Span{prcg(5) : 5 / e G G} be the 
set of eigenvectors of T with eigenvalue 1 (besides the identity). Since each of these eigenvectors was not 
shrunk by T in the first step, it is necessary to move them into a perpendicular subspace, such that the second 
step will shrink them. If [/ is a good basis change this indeed happens as captured in: 

Claim A.3. If p and U is a good basis change then U pW _L (i.e. U pW G fi-^). 

Proof, {prcgig) : 5 G G} is an orthonormal basis for /i'L {prcg{g) : 5 7^ e G G} is an orthonormal basis for 
W. Therefore, it is enough to verify that Tr(?7preg(5i)t^Vreg(52)^) = for any gi ^ e and for any g2. 
Since Prcg(92)^ = Prcg(5'2^^)> this follows directly from Property (O. □ 

We claim: 

Lemma A.3. If U is a good basis change then E is a (|rp, A) quantum expander. 

Proof. The regularity is clear from the way the superoperator E is defined. We turn to the spectral gap. 
It is easy to check that E{I) = /. Furthermore, fix any x G L(C[G]) that is perpendicular to /. Write 
X = x'l + X"*- where xH G Vl^ = Span{/Lti.g | e / 5 G G} and x"*- G p-^. Now it is not true any more that 
E{x\\)^E{x^). However, E{x) = T{(j\\ +a^), where fjH = UT{x\\)U^ and = UT{x-^)U^. We know 
a few things. First, by Claim IA31 o"II_L/xIL Also, r(xll)_LT(x-'-), and therefore cjII_L(J-'-. Finally, by Lemma 
lA.ll we know T is normal. We soon prove: 
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Lemma A.4. Let T be a normal linear operator with eigen-spaces Vi, . . . ,Vn and corresponding eigenval- 
ues Xi, . . . , Xn in descending absolute value. Suppose u and w are vectors such that u G Span {V2, ■ ■ ■ , Vn} 
and w -L u (w does not necessarily belong to Vi). Then 



\mu+wmi<\x2nu\\i + \x,nw\\i 



Using the lemma we see that: 



WEixM 



= \\T{a\\+a^)\\l 

< A'||all||2 + ||a^||2 

= A'||c/r(xii)c/t||2 + ||[/r(x^)[/t||^ 

= t\\T{J)\\l + \\T{x^)\\l 



< A^||xll||2 + A^||x-^||2 



A lk||2- 



We are left with the proof of Lemma IA!41 



Proof. (Of Lemma lA.4l ) Let {vj} be an eigenvector basis for T with eigenvalues 6j (from the set {Ai, 
Writing u = ajvj and w = j3v + J2j l^jVj with vj G Span {V2, . . . ,Vn} and G Vi, we get: 



□ 



,A„}). 



\\T{n + v)\\l 



< 



< 



j 

|AiP|/3p + 5^|5,f|ai+/3,f 

j 

\x^m'+\x2\'Y.\^,+p,\' 

+ |A2|'(E |«,f + |/3,f + Y^iap, + a,P*)) 
j j j 

iAiiw + iA2i^(EKi'+Ei/5.-i') 

j j 



where in the calculation we used the fact that J2j — (""1^) =0 because of the orthogonahty of u 
and w. □ 

A.5 A sufficient condition that guarantees a good basis change 

Definition 5. Let f be a bijection from i, j) \ p £ G,l < i,j < dp| to G. We say that f is product if 

for every p G G: 



f{p,i,j) = /l(i)-/2(i) 

for some functions /i, /2 : [dp] x [dp] G (fi and f2 may depend on p). 



(3) 
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We first give two examples. 

Example A.l. (Abelian groups). All irreducible representations are of dimension one, so just define fi{i) = 
eand f2{j) = /(p, 1,1). 

Example A.2. (The Dihedral group) The Dihedral group Dm is the group of rotations and reflections of a 
regular polygon with m sides. Its generators are r, the rotation element, and s, the reflection element This 
group has 2m elements and the deflning relations are = 1 and srs = r~^. We shall argue this group 
has a product mapping for odd m (although it is true for even m as well). The Dihedral group has ^^^y^ 
representations pi of dimension two and two representations of dimension one ti, T2. 
Our product mapping f{p, is: 



{1 Ifp = Ti,i=j = l 

S Ifp = T2,i=j = l (4) 

^2(£-l)+igj jfp ^ 

The product structure is clear from Equation 0. 

Our claim is that any group that has a product mapping can be used to construct quantum expanders. 
The parameters of the expander depend on the parameters of the classical Cayley graph given by the group. 
Optimally, we will want a group that has: 

• A constant degree Cayley expander. 

• A product mapping. 

• An efficient quantum Fourier transform. 

Abelian groups have the last two. In the next section we will show that PGL(2,q) has the first two (it is 
an open problem to find an efficient implementation of the quantum Fourier transform over PGL(2,q)). 

Lemma A. 5. Let G be a group that has a product mapping f, and let F be the Fourier transform over G, 
F b) = EpeG Ei<ij<dp \f^\Piji9) \P, hj)- Define the unitary mapping 



S : \p,i,j) ^ uj'JJf{p,i,j)) 

where Udp = e^'^'^l'^p, and set U to be the unitary transformation U = SF. Then U has property ((2]) 
and is a good basis change. 

Proof. 

Tr (^t//0reg(5l)t^Vreg(92)) = Tr (^S'FpreglsO^'^'S'Vregfe)) 

= Tr 5^ ^ Pi^i,{gi)\p,i,j){p,i',j\S'^^\g2x){3 

/ dp 

= X] Pi,i'i9i)T^'<: y^S\p,i,j){p,i' ,j\S'^'^\g2x){x\ 



Therefore, it suffices to show that for any p, i, i' we have Tr [Y^jLi S \p, i, j) {p, i' ,j\ 5*^ Ez \92x) (a 

0. Fix p G G and G {1, . . .,dp}. Since / is product, f{p,i,j) = fi{i) ■ f2{j) for some /i,/2 : 
[dp] X [dp] — > G. Denote hi = and tj = f2{j). The sum we need to calculate can be written as 
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\ ^S\p,i,j){p,i',j\S^^\g2x){x\\ = X^X^^dp T^'cilhitj) {hi'tj\g2x) {x\) 

^j = l X J j = l X 

dp 
j=l X 

where the last equahty is because we get a non-zero value iff x = hitj and hidj = g2X, which happens 
iff hitj = g2^hi'tj, i.e., g2 = hi'h~^. However, when g2 = hi'h^^ we get the sum Yl^Li^d^ * This 
expression itself is zero when i ^ i! . 

We are therefore left with the case i = i'. In this case 52 = hi'h'^^ = e. But then, 

Tr (Uprcg{gi)U'< Prcgig2)^ = Tr (Uprcgigi)U'<^ = Tr (prcgigi)) = 0, 
where the last equality follows because / e. □ 

A.6 The construction of the PGL(2,q) quantum expander 

We now work with the group G = PGL(2, of all 2 x 2 invertible matrices over Fg modulo the group center 
(the set of scalar matrices). This is one of the groups used by IILPS88II to construct Ramanujan expander 
graphs. Our goal is to show that PGL(2, q) has a product mapping. We therefore need to show a product 
bijection between G and the irreducible representations of G. How can we find such a bijection? 
We first describe the well known irreducible representations of this group. These are: 

• 2^ representations of dimension q + 1. 

• 2^ representations of dimension q — 1. 

• 2 representations of dimension q. 

• 2 representations of dimension 1. 

We need a clean bijection from G to the iiTcducible representations of G. Our approach is to use a tower 
of subgroups, Gs = G > G2 = D2q > Gi = Zq > Go = {e}, with G2 and Gi defined as follows. G2 

is generated by the equivalence classes of ^ q ^1 ) ^^'^ ( ^ • ^2 is a Dihedral subgroup of G 

with 2q elements. The first matrix is the reflection, denoted by s, and the second is the rotation, denoted by 
r. This group has a cyclic subgroup Gi = Zg (the group generated by r). 

In Figure [T] we show the product mapping visually. The figure shows the block-diagonal structure of the 
regular representation (after applying the Fourier transform). Each rectangle is an in^educible representation. 
Each color represents a different dimension: black rectangles correspond to iiTcducible representations of 
dimension q, gray rectangles correspond to irreducible representations of dimension q — I and dotted rect- 
angles correspond to irreducible representations of dimension q+ I. Notice that all rectangles fit into larger 
block diagonal rectangles of dimension 2q, marked with dashed lines. These larger rectangles correspond to 
cosets of G2. It is straightforward to verify that for any q + 1 dimensional representation (dotted rectangles 
in the figure), the product condition is satisfied by G2, by letting fi{i) determine the index in the coset, and 
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Figure 1: The product mapping of PGL(2,q). 



/2(j) determine the coset representative. Similarly, for any other representation (black and gray rectangles 
in the figure) the product condition is satisfied by G\. 

Formally, our product mapping / is defined as follows. Let i = and let T2 = {ti, . . . , ti} be a 

transversal for G2 (its size comes from the fact that |G| = q{q—'i^){q + l) = 2q£). Ti = {ti,sti, . . . ,te, stt} 
is a transversal for Gi. We denote by the xth representation of dimension d (these are all non-equivalent 
irreducible representations). 



/(pi, 1,1) = St 



(9-3)(9 + l) 
2 



f . (g-3)(9+i) {x-l)q + j<q+l 

I r'-^st. ^. , (g-3)(g+i) Otherwise 

[ I — q^ V 

As we see, for every p ^ G, f has a product structure. 

We remark that the two previous examples of product mappings (Examples I A. 1 l and IA.2I ) have also this 
subgroup structure. In the Abelian case (Example lA. II ) we use G < Go = {e} and in the dihedral case 
G = D2n < Gi = Zn < Go = {e} (or alternatively, G = D2n < Gi = {e, s} < Go = {e}). 

We are now ready to prove Theorem lA.6l 

Theorem IA.6I There exists a {D = O(^), A) quantum expander. 
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Proof. By Lemma IA31 Lemma IA3] and the description of the product mapping above, we know that E is 
a (|rp, A) quantum expander. By the IILPS88II construction we know that there exists a Cayley graph for 
PGL(2, q) with A < j^. Plugging this Cayley graph gives us a A) quantum expander. □ 



A.7 How about an 5„ Cayley construction ? 



There are explicit, constant degree (non-Ramanujan) Cayley expanders over 5„ BKasOSI . Also, there is an 
efficient implementation of the Fourier transform over Sn IIBea97l . We do not know, however, whether 
Sn has product mappings. In Sn the question takes the following form. We look for bijections / from 
pairs (P, T) of standard shapes to 5„ (a shape corresponds to an irreducible representation of 5„, and 
its dimension is the number standai^d shapes of that shape), and furthermore we want f{P,T) to equal 
fi{P) • f2{T) for some functions /i and /2 taking values in 5„ (this is the product property). 

The question of finding an explicit bijection / from pairs (P, T) of standard shapes to Sn is a basic 
question in the study of the representation theory of 5„. The canonical algorithm doing so is the "Robinson- 
Schensted" algorithm IIRob38[ rSch61ll that was extensively studied later on (see |Sag01|, and especially 



Chapter 3 that is almost dedicated to this algorithm). The R-S mapping is not product. However, a manual 
check revealed that Sn has a product mapping for n < 6. We think it is a natural question whether product 
mappings for 5„ exist, and if so it is natural to look for an exphcit description of the mapping (preferably 
by an algorithm). 

B The complexity of estimating entropy 

In this section we show that the QED problem (as defined in the introduction) is QSZK-complete, following 
the outhne in Section \5\ We prove that QEA < QSD in Section El] and that QEA < QSD implies 
QED < QSD in Section El This completes the proof that QED < QSD. We prove that QSD < QED in 
Section El 

Before we begin we need a few things. First we need a well known fact about the trace-norm. In the 
classical world SD{P,Q) = maxs P{S) — Q{S), i.e., it describes the maximal probability with which 
one can distinguish the two distributions. The trace distance achieves the same for density matrices, as is 
captured in: 

Fact B.l. (e.g., I[NC00\I } Let pQ and pi be two density matrices. Then there exists a measurement O with 
outcome or 1 such that making the measurement on pi, yields the bit b with probability | + ^° 
Furthermore, no measurement can distinguish the two density matrices better. 

As with classical distributions, the distance between density matrices can only decrease with computa- 
tion, i.e.. 

Fact B.2. ( UNCOOH ) Let po and pi be two density matrices. Then for any quantum operation £ it holds that 

||f(/90) lltr < IIPO-Pl|ltr- 

We also need the polarization lemma IIWat02ll (that is based on the work of IISV97II ). which is used 
thi^oughout the section. 

Theorem B.l. (Polarization lemma, Theorem 5 at fWatOll ) Let a and /3 satisfy < 
Then there is a deterministic polynomial-time procedure that, on input {Qo, Qi, 1") where Qq and Qi are 
quantum circuits, outputs descriptions of quantum circuits [Rq, Ri) (each having size polynomial in n and 
in the size ofQo and Qi) such that 

II IQo) - IQi) lltr < " II |i2o) - l^l) llu- < 2~". 

II IQo) - IQi) lltr > /3 ^ II |Po) - l^i) lltr > 1 - 2-". 
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B.l QEA < QSD 

In Section |5] we gave an intuitive explanation of what follows. We first prove the quantum version of the 
flattening lemma (Lemma [B. IK then describe the reduction, and argue that if the input source had much 
entropy we are close to uniform, whereas if the input source had few entropy, then applying the extractor 
does not add much entropy, and that this implies that the output state is far away from the completely mixed 
state (Lemma [B.31 ). 

Definition 6. Let p be a density matrix, A an eigenvalue of p and A a positive number. We say that A is 
A-typical //■2~^(^)"^ < A < 2-^(^)+^. We say p is A-fi&i if for every t > 0, with probability > l-2-*''+\ 
a measurement of p in its eigenvector basis results with an eigenvector whose eigenvalue is tA-typical . 

Lemma B.l. Let p be a density matrix and k a positive integer Suppose that every non-zero eigenvalue of 
p is at least 2~™. Then ®^p is A-flatfor A = \fkm. 

Proof. Let {Ai, . . . , A„} denote the set of eigenvalues of p. This implies the eigenvalues of ®^ p are 
: = Aj^ • . . . • Ajj.}. The entropy of ®^ p is S{®^ p) = k ■ S{p). Let A denote the set 

of tA-typical eigenvalues of (^^p. Thus A = |Ajj^...^jj. : | X^j=o ~ log ^ij ~ ^ " S{p)\ < tA|. Let p de- 
note the probability that a measurement of ^'^p in its eigenvector basis results an eigenvalue which is not 
tA-typical. Then by Hoeffding inequality. 



p < X < 2 exp 



-2-k - {tA/kf 



< 2exp(-2t2) < 2 



□ 



We now define the reduction. Let {Q, t) be an input to QEA, where Q is a quantum circuit with n input 
qubits and m output qubits. We first look at the circuit Q^'^ (for some q = poly(n) to be specified later). 
We let ii^ be a {qt, q{m — t) + 2 log(^) + log(gm) + 0(1), e) quantum extractor operating on qm qubits, 
where e = l/poly(n) will be fixed later. Such an extractor exists by Lemma |4~T] Let ^ = E{\Q)^'^) and let 
J ^ 2-9™/. The output of the reduction is /). 

To show correctness we prove: 



Lemma B.2. 



IfiQ,t) £ QEAy then 



< 5e. 



If{Q,t) G QEAj^ then 



> 



qm 



1 
29" 



Proof. • Proof of the first item. 

Since Q traces out at most n qubits, the eigenvalues of \Q) are all at least 2~", and by Lemma IbTT] 
we see that \Q)'^'^ is A-flat for A = y^n. Thus, with probability at least 1 — 2~^' a measurement 
of \Q) in its eigenvector basis results with an eigenvector whose eigenvalue is rA-typical. Let A 

denote the set of rA-typical eigenvalues of IQ), for r = ^Jlog{^). We write IQ)®^ in its eigenvector 
basis IQ)®^ = Aj Let ctq 

1 _ 2-^'+i. Therefore, 



Ea.gA and let cJi = p^'^ - ctq. Thus, Tr(cJo) > 



tr 



< 



< 



Eiao) + Eiai) - Tr(ao)/ - Tr(ai)/ 



^(do) - Tr(ao)/ + || ^(fxi) IL^ + Tr(c7i)I 



tr 



tr 



tr 



E{ 



1 

Tr(ao) 



o-o) 



+ 2' 



tr 
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Now we use the fact that j;^j^(7o is a density matrix with all its eigenvalues < 2 i-S{p)+rA . 



< 



rA - 1 

since we started with a yes instance for QEAy . We set the parameters such that q > r A + 1, and thus 
our density matrix has min-entropy at least qt and by the guarantee of our quantum extractor we get 



2-q-Sip)+rA+i_ jj^yg^ TvtWl^o min-cntropy at least q ■ S{p) - rA - 1 > q ■ {t + 1) 



that 



tr 



< e. Therefore, 



tr 



< e + 2 ^ < 5e, where the last inequality 



holds for r > ^^Jlog{^. 
Proof of the second item. 

Suppose that {Q, t) G QEA^y- By the definition of quantum extractors we get that 

SiO < Si\Qf'')+qim-t)+2logi-J+log{qm)+0{l] 
< q{t -l) + q{m-t) + 2 log(^) + log(gm) + 0(1) 
= qm — q + 21og(-) + log{qm) + 0(1) < qm — 1, 



where the last inequaUty follows if we choose the parameters such that g > 2 log(^)+log((7m)+0(l). 
Here we need to relate entropy to statistical distance. This is given in Lemma lB31 which we state and 



prove soon. With that we get that 



> 



tr 



qm 



1 

29" 



as required. 



□ 



The constraints we have on the parameters are g > y log(i)y^n+l and g > 2 log(i)+log(gm)+0(l). 

To this we add 5e < — • ^^^^ ensures a gap which can be amplified by Theorem IB. 11 to any 

desired gap, and completes the proof. These constraints can be easily satisfied by choosing q and to be 
appropriately large polynomials in n. 



B.1.1 Relating entropy to trace distance from the completely mixed state 

Now we relate the distance of a density matrix from uniform to a bound on its entropy. Consider the 
following classical random variable X over {0, 1}": with probability e, X samples the fixed string 0" and 
with probability 1 — e, X is uniformly distributed over {0,1}". This X has distance about e from uniform 
(e + — to be exact) and its entropy is S{p) < (1 — e)n + H{1 — e). We show that this is essentially 
the worst possible: 

Lemma B.3. Let p be a density matrix over n qubits and e > 0. If S{p) < (1 — e)n then \\ p — > 

Proof. We prove the contrapositive. Let p be a density matrix with — 2^-^||tj, <e — 2^ and minimal 
Shannon entropy. Writing p in its eigenvector basis we get p = X/j=i ^« W.l.o.g let us assume Ai is 

the lai^gest eigenvalue of p. The trace distance of p from is ^ |Aj — g^rl- For any eigenvalue Aj > 
where i 7^ 1, we can modify the eigenvalues of p such that Ai <— Ai + (Aj — and Aj ^ Since both 
Ai and Aj are > this does not affect || p — ■ Moreover, we claim this operation only decreases 

Sip): 

Lemma B.4. Let p = Yl'i=i '^i I I density matrix over n qubits with eigenvalues ( Ai > . . . > A2" )• 

Let Xj > e > for some j > 1. Let (5i = Ai + e, 6j = Aj — e and 6i = Aj for i ^ 1, j and let 
a = ^2^=1 \vi){vi\- Then S{p) > S{a). 
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We prove the lemma shortly. Thus, w.l.o.g. we can assume Aj < 2 " for all i > 1. Having that 



p-I 



:bllows that 



Ai>2- 



Xi - 2"" = Ai - 2"". As 



p-I 



< e — 2 "we conclude that Ai < e. It 



s{p) >Y,^i iog(\^') > E • ^ > (1 - < 



n. 



which completes the proof. 



□ 



Proof. (Of Lemma |R!4l ) f{x) = x log x ^ is concave. Therefore, for Xj = 6j + e = (1 — g^ts + Si-S- ^'^ 
we get: /(A,) > (1 - + jT^fiSi). Similai'ly, /(Ai) > j^f{S,) + ('l - 

Together, /(A,) + /(Ai) > /(J,) + Therefore, 

S{p) - S{a) = Ai log Ar' + Aj log Xj' - log 6^' - 6j log 
= /(Ai) + /(A,)-/(5i)-/(5,)>0. 



□ 



B.2 Closure under boolean formula 

In order to prove that QED reduces to QSD we need to generalize another classical result about SZK to 
QSZK, namely, closure under boolean formula. A special case of this is, e.g., that if 11 G QSZK then the 
promise problem that accepts (xi,X2) if xi E Hyes or X2 G ^yes and rejects if both Xi are in Uno, is also 
in QSZK. Notice that as we deal with promise problems we have yes instances and no instances and also 
"undefined" instances, and therefore we need to say how to treat those "undefined" instances in our formula. 
We define: 

Definition 7. For a promise problem 11, the characteristic function ofH is the map xn : {0,1}* — > {0,1,*} 
given by 

'1 ifx^ Uy 
Xn{x) = { ifx^YlN 



otherwise 



and. 



Definition 8. A partial assignment to variables vi, . . . ,Vk is k-tuple a = (ai, . . . , a^) G {0, 1, -k}^. For a 
propositional formula (p on variables vi, . . . ,Vk the evaluation (p{a) is recursively defined as follows: 

Vi{a) 



Notice that, e.g., A ★ = even though one of the inputs is "undefined" in 11. 
With that we define: 

Definition 9. For any promise problem 11, we define a new promise problem ^ijl) as follows: 

$(n)y = {{4),Xi,. . . ,Xm) ■■ (t>{Xn{xi),. . . ,Xll{Xm)) = 1] 
^{Ii)N = {{(t),Xi,...,Xm)-(l3{Xll{xi),...,Xn{Xm))=^} 









if(j){a) = 1 and ip{a) = 1 


ai, 




I: 


//■0(a) = OorV'(a) = 








otherwise 


if(j)[a) = 






if(j){a) = 1 or ip{a) = 1 


ifm = 1 




I; 


if (t>{a) = and ipiji) = 


otherwise 






otherwise 
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The following is an adaptation of the classical proof of IISV98II to the quantum setting: 
Theorem B.2. For any promise problem 11 G QSZK, ^{H) £ QSZK. 

Proof. Let 11 be any promise problem in QSZK. Since QSD is QSZK-complete, 11 reduces to QSD. This 
induces a reduction from <&(n) to <I>(QSD). Thus, it suffice to show that <I>(QSD) reduces to QSD. 

Claim B.l. ^{QSD) reduces to QSD. 

Proof Let It; = {(f>, {X^,Xl), (X^",^^ )) be an instance of $ (QSD). By applying De Morgan's Laws, 
we may assume that the only negations in (p are applied directly to the variables. (Note that De Morgan's 
Laws still hold in our extended boolean algebra.) By the polarization lemma (Theorem IB. 11 ) and by the 
closure of QSZK under complement (as was shown by ITWatOlll ). we can construct in polynomial time pairs 
of circuits {Y^,Y^), {Y^^, Y{^) and {Z^, Zl),..., {Z^, Zf) such that: 

(X^,Xi)GQSDy ^ |||yj\_|y/\|| >i_ J_and |||Z^>-|zi>|L < ^ 



(X^,Xi)GQSD^ ^ lll^o>-|n'>ILr<^a'^d |||Z^>-|zi>|L>l-^ 

The reduction outputs the pair of circuits (BuildCircuit((/), 0), BuildCircuit((/), 1)), where BuildCircuit is 
the following recursive procedure: 



BuildCircuit(V', h) 

1. If -0 = Vi, output Y^. 

2. if Tp = -lUj, output Zl. 

3. If ip = T V fi, output BuildCircuit(T, 6) BuildCircuit(;Li, b). 

4. If V = T A fi, output i (BuildCircuit (r,0) BuildCircuit(^, 6)) + i (BuildCircuit (r, 1) (g) 
BuildCircuit(/i, 1 - b)). 



Notice that the number of recursive calls equals the number of sub-formula of p, and therefore the 
procedure runs in time polynomial in and \Xj\, i.e., polynomial in its input length. 
We now turn to proving correctness by induction. For a sub-formula r of p, let 



A(r) = II (BuildCircuit (r, 0) - BuildCircuit (r, 1)) |0) 

We claim: 

Claim B.2. Let a = {xqsd(-^o > )> • • • > XQSni^o^ ^ Xf^)). |^ For every sub-formula ip of p, we have: 

^{a) = 1 ^ A(V^) > 1 



m 

m = o =. A(v.)<M 

Proof. By induction on the sub-formula of p. It holds for atomic sub-formula by the properties of the Y's 
and Z's. 



'we remind the reader that Xqsd('-'1' '-^2) was defined in Definition[71 
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• The case if) = t\/ ji. 



If '(/'(o) = 1 then either r(a) = 1 or ^(a) = 1. W.l.o.g., say T(a) = 1. In this case we have for any 
i G {0, 1} that BuildCircuit(T, i) = £ (BuildCircuit(?/;, i)), where £ is the quantum operation tracing 
out the registers associated with the /x sub-formula. Thus, by Fact lB.2l and by induction, 

Irl 

A(V') > A(t) > 1 - -L-i- > 1 



3101- 3|<^|' 

If tpia) = 0, then both r(a) = fi{a) = 0. 
Using 



PO ® Pi - O"0 (X" CTl lltj. < II po ® Pi - O-Q (K) pi llti- + II O-Q (g) pi - do (g) (71 ||^.j, 
= II PO - f^O lltr + II Pi - lltr ■ 



we get 



A(V) < A(t) + A(p) < ilL + |1 < 



3|(/>| 3|(/>| - 3|(^|' 



• The case = t A i^. 
Using 



^[PO 0"o + pi (g) CJi] - ^[po » fTi + Pi (g) fJo] 



1 



1^ W (PO - Pi) ^ {(^0 - cri) 



PO - Pi lltr II ^0 - <7l 



tr 



where the equalities above follow because 2 || X (g) y H^.^, = 2 || X ||^.^ 2 || y H^^,. We get A(V') 
A(r).A(p). 

If V'(o) = l^ then, by induction. 



3i0iy V m 

If = 0, then, w.l.o.g., say r(a) = 0. By induction 



AW,) = A(r) . A(,) < AM < ^ < . 



□ 



Let Ab = BuildCircuit((/), b). By the above claim if u; E $(QSD)y then || {A -B)\0) \\^^ > 2/3 and if 
w E $(QSD)Ar then || {A - B) |0) H^.^ < 1/3. Thus the claim follows. 

□ 
□ 

To finish the section we observe that 
Claim B.3. QED < ^{QEA), for some formula ^>. 
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Proof. Let (Qo) Qi) be an instance of QED. Let = ®^ \ Qi)- The output of the reduction is 

6n 

V [((^0,0 G QEAy) A G QEA^)] . 

t=i 

If (Qo, Qi) G QEDy then S'(.^o) > 'S'(^i) + 3. Thus, there exists an integer t such that (,^0, t) S QEAy 
and G QEAjv- On the other hand, if (Qo,Qi) G QED^ then ^(^i) > S'(^o) + 3. Thus, every 

integer t is either greater than S{^q) + 1 or smaller then — 1. That is, for every t, {^q, t) G QEA^y or 

(6,t)GQEAy. □ 

In particular, the closure under formula implies that if QEA < SD then QED = <I>(QEA) < QSD, as 
desired. 

B.3 QSD < QED 

B.3.1 Some quantum information backgroud 

The proof of the following facts can be found in MNCOOII . 

Fact B.3. (Joint entropy theorem) Suppose pi are probabilities, \i) are orthogonal states for a system A, 
and Pi is any set of density operators for another system B. Then 

Fact B.4. (Pannes' inequality) Suppose p and a are density matrices over a Hilbert space of dimension d. 
Suppose further that the trace distance between them satisfies t = || p — ^ ||^.^. < 1/e. Then 

\Sip)-Sia)\ < t{\nd-lnt). 

The following lemma is taken from IIANTV02II . It can be proved using Holevo's bound. 

Lemma B.5. (Lemma 3.2, liANTV029 ) Let po and pi be two density matrices, and let p = i(po + /Oi). If 
there exists is a measurement with outcome or 1 such that making the measurement on pb yields the bit b 
with probability at least p, then 

S{p)>^[S{po) + S{pi)] + {l-H{p)). 

Combining the lemma with Fact IB. II we get 
Lemma B.6. Let po <^nd pi be two density matrices, and let p = ^{po + Pi)- Then 

S{p) > l[S{po) + S(pi)] + (1 - H{\ + 

B.3.2 The proof 

Theorem B.3. For any < a < /J^ < 1, QSD^ f^ < QED. 

Proof. Given circuits Qoi Qi, We first apply the polarization lemma (Theorem lB.il ) with n = uiq and obtain 
circuits Rq,Ri. We then construct two circuits Zq and Zi as follows. Zi is implemented by a circuit which 
first applies a Hadamard gate on a single qubit b, measures b and then conditioned on the result it applies 
either Rq or Ri. The output of Zi is 1 10) (0| ® |i?o) + | 1 1) (1| (X" l-Ri)- Zq is the same as Zi except that b is 
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traced out. The output of is ^ |i?o) + 5 l^i)- The output of C is simply a qubit in the completely mixed 
state. 

The reduction outputs the following pair of circuits: {Zq (g) Zq C, Zi (g) Zi). 

The intuition behind the reduction is as follows. First consider the case when \Rq) and \Ri) are very 
close to each other, the matrix ^ \Rq) + ^ is very close both to \Rq) and to |i?o)> thus we "lose" the bit 
of information telling us which circuit was activated. However, the matrix \ |0) (0| ® \Rq) + \ \V){l\®\Ri) 
does contain this bit of information, i.e. has increased entropy. On the other hand, whenever \Rq) and \Ri) 
are very far, the matrix ^ |iio) + ^ l^i) does contain almost the same amount of information as ^ |0)(0| ® 
\Ro) + \\l){l\®\Ri). 

Claim B.4. //(Qo, Qi) e {QSD^^p)no then {Zq ® Zq C, Zi ® Zi) G QED^^q 

Proof. We know that || \Qq) — \Qi) \\^^ < a. By the Polarization lemma (Theorem lB. II) we get || \Rq) — \Ri) H^.^, < 
gy the joint-entropy theorem (Fact IB. 3l ). 

Si\Z,)) = ^iSi\Ro)) + S{\Ri))) + 1. 

On the other hand, |Zo) is very close both to \Rq) and to \Ri). Specifically, || |Zo) — |-Ri) = 
II i \Ro) - \ \R\) 11^^ < 2~"'o. Therefore, by Fennes inequality (FactEl \S(\Zq)) - S{\Ri))\ < 2"'"o • 
poly(mo) < 0.1 , for large enough m^. Similarly, \S{\Zq)) - 5(|i?o))| < 0.1. It follows that 

|5(|Zo))-i(5(|i?o)) + 5(|fii)))|<0.1. 

Combining the two equations we get 5(1 Zi)) -5(1 Zo)) > 0.9. Thus, 5(|Zi ® Zi))-S'(|Zo Zq C)) > 
2 * 0.9 - 1 = 0.8. Therefore, (Zq Zq C, Zi Zi ) E QED^^ □ 

Claim B.5. //(Qo, Q\) G (G5D^,/3)yB5 then (Zq ® Zq ® C, Zi ® Zi) G QEDyes 

Proof. By the Polarization lemma (Theorem IB. II ) || Po — pi ||tr ^ 1 ~ 2"™". Using the Holevo bound 
(LemmaESl) we getthat S(|Zo)) > \ [5(po) + S{pi)] + 1 - ^(i + " ) > \[S{p^) + S{pi)] + l- 

^(2'™o). By FactUwe know that S{\Zi) = \{S{po) + S{pi)) + 1. Therefore, 5(|Zi)) - 5(|Zo)) = 
i7(2^'"o) < 0.1 for sufficiently large mo. 

In particular, S{\Zi ® Zi)) - S'dZo Zo (g) C)) < 2 * 0.1 - 1 = -0.8 and (Zq Zq ® C, Zi Zi) G 
QEDyes 

□ 



□ 



C Quantum extractors 

Lemma C.l. IfT : L{V) — > L{V) is a {D = 2*^, A) quantum expander, then for every t > 0, T is also a 
{k = n — t, d, e) quantum extractor with e = 2*/^ • A. 

Proof. T has a dimension 1 eigenspace Wi with eigenvalue 1, spanned by the norm 1 eigenvector vi = 
(where dim{V) = N). Our input p is a density matrix and therefore {p \ vi) = -^Tr(p) = In 
particular p — -^vi = p — I is perpendicular to Wi. Therefore, 

= ||T(p-/)||i < A'||p-/||i 

= Awpwi - {p\i) - m + ml]=^'[\\p\\l - ^] < A'liHii- 
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Plugging H2{p) > Hooip) >k = n-t we see that | |r(p) -/||| < A'2"("^*). Using Cauchy-Schwartz 



T{p)-i < //V||r(p) - 7||2 < ViV-A-2-V = 2*/2.A 



tr 

□ 



Theorem ll.3[ Any (D, A) quantum expander satisfies A > 



3V3D 



Proof. Let be a (D, A) quantum expander operating on the space of n qubits. Let d = logD, and let 
(5 > be a constant to be fixed later. We first apply Lemma |4~T] with t = d — 2 log 6 to deduce that E is a. 
(n-d + 21og 6, d, 6~^2'^'^\) quantum extractor. 

The proof idea is to take a density matrix which is uniform on a set of "small size". Applying the 
extractor yields a density matrix close to the completely mixed state. Such a matrix must have a high rank. 
On the other hand, because we started with a low-rank matrix, the resulting density matrix cannot have a 
too-high rank (since E is D-regulai^. 

Formally, let p G D{V) be a density matrix of a flat (classical) probability distribution over a set of size 
2n-a!+2iog<5_ gy definition, H^{p) = n - d + 2 log 5. Also, log(rank(p)) = n - d + 2 log 5. 

Using the quantum extractor definition we get that E{p) is (5^^2'^/^A-close to the completely mixed 
state. Hence, 

rank(S(p)) > (1 - 5^^2'^/^\)2'' . 

On the other hand, since E is 2^^ -regular, E{p) is a sum of 2'^ matrices. Each of these matrices has rank 

2n-d+2\og5_ Hence, 

rank(^(p)) < 2'^2""^+2iog5 ^ 2",52_ 
Combining the two inequalities gives 

A > 5(1- 52)2-^/2 = 



Taking 5 = 1/ \/3 completes the proof. □ 
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